Fix the four findings of the second review

README.md: the opening no longer says the private key is needed only to
restore; a backup never needs it, a deep verify does.

ARCHITECTURE.md: the concurrency note says each open database uses one
connection, since the metadata export opens a second one.

docs/REPOSTRUCTURE.md: the size leak is about a secret near the
outsider's data in the same blob, not the same chunk, because all new
chunks of a blob share one zstd stream.

Every path used as link text in the four documents is in backticks.

Model: fable-5-1

docs/DATAMODEL.md

@@ -135,7 +135,7 @@ One row for each blob.
 - `uploaded_ts`: when the upload finished. It is `NULL` before that.
 
 `blob_hash` is `hex(SHA256(SHA256(uncompressed contents)))`. See
-[REPOSTRUCTURE.md](REPOSTRUCTURE.md#blobs).
+[`REPOSTRUCTURE.md`](REPOSTRUCTURE.md#blobs).
 
 Once a blob is uploaded, `compressed_size` is the size of the object at the
 destination. A blob that was already there can have a different size from the